IONOS vs Myra CDN

Compare IONOS y Myra CDN en capacidades, jurisdicción, garantías y encaje para compradores europeos.

Logo: Myra CDN

Myra CDN

Germany· Web Hosting and Cloud Computing

Needs review

Shortlist Myra CDN when you need a German-operated Anycast edge with DDoS/WAF and a written Germany-only TLS termination option for KRITIS, banking, or public-sector sites. Skip it when you need Cloudflare-scale self-serve PoPs, Workers-class edge compute, or a free global cache. Consider Hetzner, IONOS, or OVHcloud when you only need EU origin hosting, not a certified WAAP edge.

EU-operated (Munich GmbH)ISO 27001 IT-Grundschutz (BSI, verified)BSI C5 Type 2 (claimed)Anycast CDN + Layer 7 DDoSGermany TLS termination (on request)PCI DSS Level 1 (claimed)
IONOS vs Myra CDN: Resumen
CaracterísticaLogo: IONOSIONOSLogo: Myra CDNMyra CDN
País de origenGermanyGermany
CategoríaCloud ComputingWeb Hosting and Cloud Computing
Código abiertoNoNo
AutoalojadoNoNo
SedeNo indicadoGermany
Entidad legalNo indicadoMyra Security GmbH, Landsberger Str. 187, 80687 Munich, HRB 202428
Matriz / control EE.UU.No indicadoSin matriz estadounidense conocida
Exposición CLOUD Act (indicativa)No indicadoBajo
Alojamiento / residenciaNo indicadoVendor-operated Anycast filter/CDN plane. BSI cert describes six outsourced data-centre sites (operators not named) with Myra staff running the IT. Marketing describes globally placed PoPs. Germany-only TLS termination and exclusive German processing are available on request. Product subprocessor list not published. Marketing website uses US SaaS (GA4, Clarity, Mailjet/Mailgun, Storylane, and others).
Resumen

German hosting and cloud provider (IONOS SE): domains and SMB web hosting plus IONOS Cloud IaaS/PaaS with EU and US locations, managed Kubernetes, object storage, and DBaaS.

Munich-operated Anycast CDN and Security-as-a-Service edge (DDoS, WAF, bot management) with optional Germany-only TLS termination.

Etiquetas
De un vistazo: IONOS vs Myra CDN
De un vistazoLogo: IONOSIONOSLogo: Myra CDNMyra CDN
HQNo indicadoMunich, Germany (Landsberger Str. 187)
Legal entityNo indicadoMyra Security GmbH, HRB 202428
FoundedNo indicado2012 (vendor about/contact pages)
Product typeNo indicadoSaaS Anycast CDN + Security-as-a-Service (not self-hosted)
OnboardingNo indicadoDNS cutover + TLS upload; APIv2 at apiv2.myracloud.com
Commercial modelNo indicadoB2B subscription or quote (monthly/annual prepay); no consumer terms
ISO 27001No indicadoBSI-IGZ-0667-2024, DDoS-Schutz scope, valid to 2027-12-17
Key capabilities: IONOS vs Myra CDN
Key capabilitiesLogo: IONOSIONOSLogo: Myra CDNMyra CDN
EU-operated (Munich GmbH)No indicado
ISO 27001 IT-Grundschutz (BSI, verified)No indicado
BSI C5 Type 2 (claimed)No indicado
Anycast CDN + Layer 7 DDoSNo indicado
Germany TLS termination (on request)No indicado
PCI DSS Level 1 (claimed)No indicado

IONOS

  • Servicios diversos de hosting y dominios

    IONOS proporciona opciones de hosting compartido, VPS, dedicado y en la nube escalables para cualquier necesidad. Registra más de 22 millones de dominios e incluye un dominio gratuito el primer año en muchos planes. Los constructores de sitios web incorporan IA para configuraciones rápidas, mientras las herramientas ecommerce gestionan tiendas online. El correo se integra con Microsoft 365 o Google Workspace, garantizando comunicación fiable sin dependencias de terceros.

  • Infraestructura avanzada en la nube

    La plataforma ofrece clústeres Kubernetes gestionados, bases de datos como MongoDB y PostgreSQL, object storage, servidores GPU y un AI Model Hub para cargas de trabajo de aprendizaje automático. Los centros de datos logran certificación Tier IV para redundancia. Los clientes acceden al 99,99 % de disponibilidad, con opciones de computación de alto rendimiento adecuadas para empresas que ejecutan aplicaciones complejas.

  • Seguridad, soporte y sostenibilidad

    La protección DDoS salvaguarda sitios, complementada por certificados SSL gratuitos. El soporte funciona 24/7 vía teléfono, chat y correo, con consultores personales asignados a cuentas. Todos los centros de datos usan energía 100 % renovable, alineándose con la Estrategia Climática 2030 de IONOS que apunta a reducir emisiones mediante biocombustibles y asociaciones con proveedores.

Myra CDN

  • Anycast CDN with RAM cache and HTTP/2

    Content is cached in RAM with real-time invalidation and stale-object support, then delivered over Anycast IPv4/IPv6. Protocols on the CDN sheet are HTTP/1.1 and HTTP/2. Image optimisation includes WebP conversion and on-the-fly resizing via query string. Docs also mention HTTP, HTTPS, DNS, IMAP, and SMTP on the wider platform, plus automatic IPv4/IPv6 translation for IPv4-only origins.

  • Optional mTLS and signed URLs at the edge

    Clients can authenticate to the CDN with a client certificate. The CDN can also present a client certificate to the origin so only Myra reaches origin. Signed URLs add a cryptographic signature and optional expiry. TLS 1.2/1.3 is stated. These controls are optional add-ons, not defaults for every domain.

  • Layer 7 DDoS on the same reverse proxy

    Malicious HTTP is filtered in Myra's network before a redundant reverse proxy forwards clean traffic. Documented controls include GeoIP blocking, rate limits, attack notifications, post-mitigation reports, and upstream monitoring. Network-layer cloud scrubbing and on-prem BGP protection are separate products for IP prefixes. Vendor capacity claims (for example 1 Tbps class attacks) should be validated in an RFP, not treated as a measured SLA.

  • WAF, bot management, and EU CAPTCHA add-ons

    The CDN is sold as a stack with Hyperscale WAF, deep bot management, and Myra EU CAPTCHA (cookie-free, hashed telemetry, optional dedicated DE/EU endpoints). A managed WAF service is offered as an add-on. This is useful for KRITIS and banking sites that want one German operator. It is not a reason to assume every module is included in a CDN-only quote.

  • Germany-only TLS termination on request

    Because WAF and DDoS inspection decrypt HTTPS, Myra states it will terminate TLS exclusively in Germany when the customer requests it. Exclusive processing in German data centres is the same kind of option. If the contract is silent, marketing still describes globally placed PoPs. Write the region constraint into the order form.

  • REST APIv2, Myra App, and DNS cutover

    Go-live is DNS (A/AAAA to Myra, CNAME, or moving authoritative DNS) plus certificate upload via the Myra App or API. APIv2 is documented at apiv2.myracloud.com and can create domains, change cache settings, and edit DNS. Docs also cover SSO, certificate management, waiting rooms, object storage, WebSockets, and maintenance pages. There is no official self-host of the filter plane.

Assurance & compliance: IONOS vs Myra CDN
Assurance & complianceLogo: IONOSIONOSLogo: Myra CDNMyra CDN
Independent security / no-logs auditNo indicado
Partial

Vendor states regular external pen tests and audits. No public no-logs audit PDF. Independent C5 work in 2022 was described by usd AG. Ask for current pentest and attestation reports.

ISO 27001 (BSI IT-Grundschutz)No indicado
Verified

BSI-IGZ-0667-2024, issued 2024-12-18, valid to 2027-12-17. Scope is Myra Security DDoS-Schutz at six outsourced DC sites, not automatically every CDN PoP.

SOC 2 / SOC 3No indicado
Not found

No SOC 2 report published. Closest published control attestations are BSI C5 Type 2 (claimed) and IDW PS 951 Type 2 / ISAE 3402 (claimed).

GDPR / EU data protectionNo indicado
Vendor claimed

German controller/processor, GDPR pages, optional Germany-only TLS termination. Confirm DPA and processing locations in contract.

US CLOUD Act exposure (indicative)No indicado
Partial

EU entity, no known US parent, self-operated filter plane. Partial because CDN PoPs are described as global, six DC sites are outsourced and unnamed, and no product subprocessor register was found. Not legal advice. Vendor claims it is not subject to CLOUD Act/FISA 702.

Data processing agreement (B2B)No indicado
Not found

No public Art. 28 DPA PDF on legal/GDPR/terms pages. EU CAPTCHA FAQ asks whether a DPA must be signed, which implies one exists for that product. Request the current AVV.

EU AI ActNo indicado
Not applicable

CDN/WAAP edge. Marketing mentions AI-powered DDoS detection. Not an AI-system product page.

BSI C5 Type 2No indicado
Vendor claimed

Current Type 2 claimed on certifications page. usd AG publicly described a 2022 C5 audit with HKKG. Current-year attestation PDF not found.

PCI DSS Level 1No indicado
Vendor claimed

Vendor certifications page: PCI DSS Level 1 service provider. No public AOC in this research pass.

IDW PS 951 Type 2 (ISAE 3402)No indicado
Vendor claimed

Vendor claim of Type 2 over a twelve-month period. Report not published.

KRITIS operator (BSIG section 8a(3))No indicado
Vendor claimed

Vendor certifications page. Confirm current attestation in procurement.

Considerations & known limitations: IONOS vs Myra CDN
Considerations & known limitationsLogo: IONOSIONOSLogo: Myra CDNMyra CDN
Global PoPs unless Germany-only is contractedNo indicado
Medium

Marketing describes worldwide Anycast delivery. Germany-only TLS termination and exclusive German processing are request options. A silent contract can leave visitor IPs and cached objects on unpublished PoPs outside Germany.

Outsourced DCs and no public subprocessor listNo indicado
Medium

BSI-IGZ-0667-2024 states six independent data-centre sites are outsourced. Operators are not named. No product subprocessor register was found. Procurement should demand the annex before treating the path as EU-only.

ISO 27001 scope is DDoS-Schutz, not every SKUNo indicado
Low

The verified BSI certificate covers the DDoS-protection information network. CDN add-ons, object storage, EU CAPTCHA, and the marketing website are not automatically in that sentence. Align the statement of applicability with the ordered products.

Smaller public footprint than CloudflareNo indicado
Medium

No public worldwide PoP map comparable to large US CDNs. HTTP/3 is not listed on the CDN spec sheet. Poor fit if you need self-serve global scale or edge compute.

Corporate website uses US processorsNo indicado
Low

Privacy policy names Google Analytics, Clarity, Mailjet/Mailgun, Storylane, and other US-linked tools for the website. Separate this from product traffic, but do not treat the privacy policy as proof that the CDN path is US-free.

Encaje

IONOS

Best fit when

No indicado

Poor fit when

No indicado

Myra CDN

Best fit when

  • German or EU public sector, KRITIS, banks, insurers, and healthcare portals that must show BSI-shaped evidence
  • Teams replacing Cloudflare primarily for jurisdiction, not for Workers or a free tier
  • Sites that will contract Germany-only TLS termination and want one operator for CDN, WAF, and DDoS
  • Origins that can cut over via DNS and certificate upload without installing an appliance
  • Buyers who need REST APIv2, SSO, and SIEM-oriented logs rather than a hobby CDN

Poor fit when

  • Buyers who need a large free tier or fully self-serve global CDN comparable to Cloudflare
  • Workloads that require published HTTP/3, Workers-style edge compute, or a public worldwide PoP map before RFP
  • Organisations that cannot accept unnamed colocation partners without a signed subprocessor annex
  • Consumer or hobby projects (terms exclude consumers)
  • Teams that only need EU VMs or object storage and do not need a WAAP edge

Consider instead when

  • When: You need maximum global PoP density, Workers-style compute, or a self-serve free CDN

    Consider: Cloudflare

    US parent and CLOUD Act exposure are the usual reason regulated EU buyers leave it.

  • When: You only need EU origin compute or hosting, not Anycast WAAP

    Consider: Hetzner, IONOS, or OVHcloud

    These are catalog infrastructure peers, not certified German DDoS/CDN edges.

Open questions for due diligence

IONOS

No indicado

Myra CDN

  • Will Myra sign an Art. 28 DPA for the CDN/WAF/DDoS order and attach a current subprocessor list that names the six certified DC operators?
  • Which PoP countries will serve our hostnames if we do not buy exclusive German processing?
  • Does BSI-IGZ-0667-2024 include the exact PoPs and products in our statement of work, and can we see the current C5 Type 2, PCI AOC, and IDW PS 951 reports?
  • Is HTTP/3, IPv6-only origins, or Workers-like edge compute on the roadmap, and what is the contracted SLA for our SKU?
  • Are there US-group transit, colocation, or support tools on the product data path that are not listed publicly?